PK62784: COM.IBM.WEBSPHERE.REGISTRY.USEREGISTRY PROPERTY NOT BEING USED BY SECURITY WHEN SET TO LOCAL.

Java SDK 1.5 SR8 Cumulative Fix for WebSphere Application Server
Java SDK 1.5 SR8 Cumulative Fix for WebSphere Application Server
Java SDK 1.5 SR10 Cumulative Fix for WebSphere Application Server
6.1.0.31: Java SDK 1.5 SR11 FP1 Cumulative Fix for WebSphere Application Server
6.1.0.33: Java SDK 1.5 SR12 FP1 Cumulative Fix for WebSphere
6.1.0.29: Java SDK 1.5 SR11 Cumulative Fix for WebSphere Application Server
6.1.0.35: Java SDK 1.5 SR12 FP2 Cumulative Fix for WebSphere
6.1.0.37: Java SDK 1.5 SR12 FP3 Cumulative Fix for WebSphere
6.1.0.39: Java SDK 1.5 SR12 FP4 Cumulative Fix for WebSphere Application Server
6.1.0.41: Java SDK 1.5 SR12 FP5 Cumulative Fix for WebSphere Application Server
6.1.0.43: Java SDK 1.5 SR13 Cumulative Fix for WebSphere Application Server
6.1.0.45: Java SDK 1.5 SR14 Cumulative Fix for WebSphere Application Server
6.1.0.47: WebSphere Application Server V6.1 Fix Pack 47
6.1.0.47: Java SDK 1.5 SR16 Cumulative Fix for WebSphere Application Server

APAR status

• Closed as program error.

Error description

• When trying to use only the local OS registry with Windows, and
  setting the custom property:
  
  com.ibm.websphere.registry.UseRegistry=local
  
  We still try and look the user up in the Domain.  From WebSphere
  security tracing, we still see the following:
  
  [11/4/07 15:43:25:313 EST] 00000022 NTRegistryImp 3   Native
  line 894:
  getUsers() serverName : \SERVER-NAME
  [11/4/07 15:43:25:313 EST] 00000022 NTRegistryImp 3   Native
  line 907:
  getUsers() realmName : DOMAIN-NAME
  [11/4/07 15:43:25:610 EST] 00000022 NTRegistryImp 3   Native
  line 948:
  Error 1326 calling getUsers()
  
  The com.ibm.websphere.registry.UseRegistry property is not being
  correctly read by WebSphere Application Server.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of WebSphere Application Server   *
  ****************************************************************
  * PROBLEM DESCRIPTION: When trying to use Windows NT local     *
  *                      Domain Registry security fails          *
  *                      with message SECJ0233E unknown user     *
  *                      name or bad password.                   *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  Both registries are being initialized because the security
  property
  com.ibm.websphere.registry.UseRegistry, that is checked in the
  UserRegistryImpl and NTRegistryImpl, is not passed by
  ValidateAdminName class.
  

Problem conclusion

• ValidateAdminName class needs to be changed to pass configured
  properties to user registries.
  
  The fix for this APAR is currently targeted for inclusion in
  fixpack 6.1.0.19.  Please refer to the Recommended Updates
  page for delivery information:
  http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBSPH APP SERV

• Fixed component ID

  5724J0800

Applicable component levels

• R61A PSY

     UP

• R61H PSY

     UP

• R61I PSY

     UP

• R61P PSY

     UP

• R61S PSY

     UP

• R61W PSY

     UP

• R61Z PSY

     UP